scikit-learn 1.9.1

Source: https://github.com/scikit-learn/scikit-learn
Artifact scanned: scikit_learn-1.9.1.tar.gz (sdist · 7.4 MB · SHA-256 629cada3e33e…)
Compared with: scikit_learn-1.9.0.tar.gz (8 signals introduced since)
Files: 1185 scanned, 364 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 15 info
Scan time: 13.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 15 of 15 warn and critical signals; 15 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 06:52

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review dynamic-import sklearn/externals/array_api_compat/cupy/__init__.py:12:1 new in this release

`__import__` called on a non-literal expression (ast pass, confidence 0.90)
```
# See the comment in the numpy __init__.py
__import__(__spec__.parent + '.linalg')
__import__(__spec__.parent + '.fft')
```
likely benign LLM, confidence 0.93 Vendored array API shim imports its own linalg and fft submodules.
Reasoning
Vendored array_api_compat code importing its own linalg and fft submodules relative to __spec__.parent, with a comment explaining the vendoring rationale. Benign.
info ~~critical~~ → info by review dynamic-import sklearn/externals/array_api_compat/cupy/__init__.py:13:1 new in this release

`__import__` called on a non-literal expression (ast pass, confidence 0.90)
```
__import__(__spec__.parent + '.linalg')
__import__(__spec__.parent + '.fft')

__array_api_version__: Final = '2025.12'
```
likely benign LLM, confidence 0.93 Vendored array API shim imports its own linalg and fft submodules.
Reasoning
Same vendored self-submodule import of linalg and fft; no external input or decoding.
info ~~critical~~ → info by review dynamic-import sklearn/externals/array_api_compat/dask/array/__init__.py:16:1 new in this release

`__import__` called on a non-literal expression (ast pass, confidence 0.90)
```
# See the comment in the numpy __init__.py
__import__(__spec__.parent + '.linalg')
__import__(__spec__.parent + '.fft')
```
likely benign LLM, confidence 0.93 Vendored dask array shim imports its own linalg and fft submodules.
Reasoning
Vendored array_api_compat dask module importing its own submodules by relative spec parent; benign.
info ~~critical~~ → info by review dynamic-import sklearn/externals/array_api_compat/dask/array/__init__.py:17:1 new in this release

`__import__` called on a non-literal expression (ast pass, confidence 0.90)
```
__import__(__spec__.parent + '.linalg')
__import__(__spec__.parent + '.fft')

__all__ = sorted(
```
likely benign LLM, confidence 0.93 Vendored dask array shim imports its own linalg and fft submodules.
Reasoning
Same vendored self-import pattern; benign.
info ~~critical~~ → info by review dynamic-import sklearn/externals/array_api_compat/numpy/__init__.py:22:1 new in this release

`__import__` called on a non-literal expression (ast pass, confidence 0.90)
```
# dynamically so that the library can be vendored.
__import__(__spec__.parent + ".linalg")

__import__(__spec__.parent + ".fft")
```
likely benign LLM, confidence 0.93 Vendored numpy shim imports its own linalg submodule.
Reasoning
Vendored numpy shim importing its own linalg submodule relative to package; the comment documents the purpose. Benign.
info ~~critical~~ → info by review dynamic-import sklearn/externals/array_api_compat/numpy/__init__.py:24:1 new in this release

`__import__` called on a non-literal expression (ast pass, confidence 0.90)
```
__import__(__spec__.parent + ".fft")

from .linalg import matrix_transpose, vecdot  # type: ignore[no-redef]  # noqa: F401
```
likely benign LLM, confidence 0.93 Vendored numpy shim imports its own fft submodule.
Reasoning
Vendored numpy shim importing its own fft submodule; benign.
info ~~critical~~ → info by review dynamic-import sklearn/externals/array_api_compat/torch/__init__.py:13:1 new in this release

`__import__` called on a non-literal expression (ast pass, confidence 0.90)
```
# See the comment in the numpy __init__.py
__import__(__spec__.parent + '.linalg')
__import__(__spec__.parent + '.fft')
```
likely benign LLM, confidence 0.93 Vendored torch shim imports its own linalg and fft submodules.
Reasoning
Vendored torch shim importing its own linalg and fft submodules; benign.
info ~~critical~~ → info by review dynamic-import sklearn/externals/array_api_compat/torch/__init__.py:14:1 new in this release

`__import__` called on a non-literal expression (ast pass, confidence 0.90)
```
__import__(__spec__.parent + '.linalg')
__import__(__spec__.parent + '.fft')

__array_api_version__: Final = '2025.12'
```
likely benign LLM, confidence 0.93 Vendored torch shim imports its own linalg and fft submodules.
Reasoning
Same vendored torch self-import pattern; benign.
info ~~critical~~ → info by review dynamic-import doc/sphinxext/github_link.py:43:14

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
    class_name = info["fullname"].split(".")[0]
    module = __import__(info["module"], fromlist=[class_name])
    obj = attrgetter(info["fullname"])(module)
```
likely benign LLM, confidence 0.93 Docs helper imports a module by name to locate an object's source file.
Reasoning
Sphinx extension resolving a documented object's module by name from its own fullname metadata to find source for a GitHub link; a standard doc-tooling pattern with no network, decoding, or shell involved.
info ~~critical~~ → info by review dynamic-import doc/sphinxext/github_link.py:62:56

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
    try:
        fn = os.path.relpath(fn, start=os.path.dirname(__import__(package).__file__))
    except ValueError:
        return None
```
likely benign LLM, confidence 0.90 Docs helper imports a package dynamically to compute a relative source path.
Reasoning
Imports a package named by the documented module to compute a relative path for a source link. Benign documentation tooling, though the import is dynamic.
info ~~warn~~ → info by review dynamic-attribute sklearn/__init__.py:134:20

reach-by-name through `globals` (ast pass, confidence 0.60)
```
        try:
            return globals()[name]
        except KeyError:
            raise AttributeError(f"Module 'sklearn' has no attribute '{name}'")
```
likely benign LLM, confidence 0.92 Lazy module __getattr__ looks up names in the module's own globals.
Reasoning
Module-level __getattr__ returning globals()[name] for lazy attribute access, raising AttributeError otherwise. Standard PEP 562 lazy-loading idiom with no external input.
info ~~warn~~ → info by review dynamic-attribute sklearn/datasets/__init__.py:166:16

reach-by-name through `globals` (ast pass, confidence 0.60)
```
    try:
        return globals()[name]
    except KeyError:
        # This is turned into the appropriate ImportError
```
likely benign LLM, confidence 0.92 Lazy module __getattr__ reads module globals by name.
Reasoning
Same PEP 562 __getattr__ pattern reading the module's own globals; a benign lazy-import idiom.
info ~~warn~~ → info by review frame-introspection sklearn/tests/metadata_routing_common.py:47:13

`inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)
```
    ]
    stack = inspect.stack()
    # for callee, extract the innermost `function` (which is in METHODS) from the
    # stack; for caller, extract the *outermost* matching function so the expected
```
likely benign LLM, confidence 0.90 Test helper inspects the call stack to match caller and callee names.
Reasoning
Test helper using inspect.stack to find the calling function for metadata routing assertions. Frame introspection in tests is ordinary and benign.
info ~~critical~~ → info by review dynamic-import sklearn/tests/test_common.py:147:19

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
            continue
        package = __import__(modname, fromlist="dummy")
        for name in getattr(package, "__all__", ()):
            assert hasattr(package, name), "Module '{0}' has no attribute '{1}'".format(
```
likely benign LLM, confidence 0.92 Test imports sklearn submodules by name to verify __all__ contents.
Reasoning
Test iterating over sklearn's own module names and checking that __all__ entries exist; the modname comes from internal package walking. Benign.
info ~~critical~~ → info by review dynamic-import sklearn/utils/tests/test_estimator_checks.py:1729:13

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
        try:
            importlib.__import__(lib)
        except ImportError:
            raise SkipTest(f"Library {lib} is not installed")
```
likely benign LLM, confidence 0.92 Test imports an optional library to decide whether to skip.
Reasoning
Test checks whether an optional library is installed and skips otherwise. Benign and conventional.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o scikit_learn-1.9.1.tar.gz https://files.pythonhosted.org/packages/d2/eb/eaf5e07fcc0da7149b0e084f24e54edd7441b9a89ce7e034032ae97fe3a0/scikit_learn-1.9.1.tar.gz
printf '%s  %s\n' 629cada3e33e2b9bf376cdc7614a47a4140b8aedc1d836579e359736fbd82977 scikit_learn-1.9.1.tar.gz | shasum -a 256 -c -
mkdir pkg && tar -xzf scikit_learn-1.9.1.tar.gz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg